CSDL Home D DSN 2006 2013 43rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN)
June 25, 2006 to June 28, 2006
Cliff C. Zou , University of Central Florida
Ryan Cunningham , University of Central Florida
DOI Bookmark: http://doi.ieeecomputersociety.org/10.1109/DSN.2006.38
Because "botnets" can be used for illicit financial gain, they have become quite popular in recent Internet attacks. "Honeypots" have been successfully deployed in many defense systems. Thus, attackers constructing and maintaining botnets will be forced to find ways to avoid honeypot traps. In this paper, we present a hardware and software independent honeypot detection methodology based on the following assumption: security professionals deploying honeypots have liability constraints such that they cannot allow their honeypots to participate in real (or too many real) attacks. Based on this assumption, attackers can detect honeypots in their botnet by checking whether the compromised machines in the botnet can successfully send out unmodified malicious traffic to attackers? sensors or whether the bot controller in their botnet can successfully relay potential attack commands. In addition, we present a novel "two-stage reconnaissance" worm that can automatically construct a peer-to-peer structured botnet and detect and remove infected honeypots during its propagation stage. Finally, we discuss some guidelines for defending against the general honeypot-aware attacks.
Cliff C. Zou, Ryan Cunningham, "Honeypot-Aware Advanced Botnet Construction and Maintenance", DSN, 2006, 2013 43rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN), 2013 43rd Annual IEEE/IFIP International Conference on Dependable Systems and Networks (DSN) 2006, pp. 199-208, doi:10.1109/DSN.2006.38